100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 420
A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. Which observed result would most directly prove the design meets the intended goal?
- Control-plane endpoint mappings resolve and separate packet captures show VXLAN data forwarding between fabric edges.
- Neighbor relationships recover while supported forwarding state remains stable during the tested restart.
- Guest clients roam as designed and cannot access restricted enterprise segments.
- Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
Explanation
Correct Answer
D:Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It does not verify the present outcome.
B:This observation relates to a different topology: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It does not verify the present outcome.
C:This observation relates to a different topology: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It does not verify the present outcome.
Question 421
An acquisition introduces 172.16.0.0/12 internal networks but the network must hide finance VLAN prefixes from the partner site. Which observed result would most directly prove the design meets the intended goal?
- Partner routing tables contain only the approved shared-services routes.
- Both routed uplinks forward to the rest of campus and a link failure reroutes traffic without a campus STP event.
- Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability.
- Switches participate in the expected common region and root placement is consistent per instance.
Explanation
Correct Answer
A:Use targeted route distribution policy and VRF containment for sensitive prefixes. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. It does not verify the present outcome.
C:This observation relates to a different topology: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It does not verify the present outcome.
D:This observation relates to a different topology: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. It does not verify the present outcome.
Question 422
A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. Which observed result would most directly prove the design meets the intended goal?
- Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure.
- Receiver ports are present in membership tables and only eligible ports receive the stream.
- Delay-sensitive traffic receives scheduled treatment at both campus and WAN congestion points.
- Priority queuing protects genuine voice media while backup traffic no longer occupies the strict-priority class.
Explanation
Correct Answer
C:Extend consistent class scheduling to each actual bottleneck along the end-to-end path. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Two business units share one management VLAN with unrestricted access to each other's routers. It does not verify the present outcome.
B:This observation relates to a different topology: A multicast network has active PIM neighbors but one edge switch suppresses IGMP reports after an access-layer topology change. It does not verify the present outcome.
D:This observation relates to a different topology: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not verify the present outcome.
Question 423
An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. Which observed result would most directly prove the design meets the intended goal?
- The client negotiates capabilities and receives model-based Get/Subscribe responses from the intended target.
- Deployment responsibilities correctly assign code and app security to the customer while platform maintenance follows provider terms.
- The collector receives actionable measurements without saturating management transport or device CPU.
- Approved configuration changes use the negotiated datastore and produce attributable RPC replies.
Explanation
Correct Answer
D:Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. It does not verify the present outcome.
B:This observation relates to a different topology: A development team consumes a managed runtime that deploys application code without administering underlying servers and calls it raw IaaS. It does not verify the present outcome.
C:This observation relates to a different topology: A fleet telemetry design streams all available operational leaves every second over a constrained management link. It does not verify the present outcome.
Question 424
A global company uses the old terms vSmart, vManage and vBond in documentation but assigns control and management functions to the wrong products. Which observed result would most directly prove the design meets the intended goal?
- Existing permitted edge-to-edge tunnels continue carrying traffic across a management-plane interruption where supported.
- Operations diagrams identify correct components for onboarding, OMP routes and policy distribution.
- Large application sessions succeed with correct effective packet sizing over each approved transport.
- The branch establishes the required controlled overlay sessions without depending on unsupported unsolicited inbound access.
Explanation
Correct Answer
B:Map Cisco SD-WAN Controller, Manager and Validator functions to their actual roles, including legacy labels. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. It does not verify the present outcome.
C:This observation relates to a different topology: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not verify the present outcome.
D:This observation relates to a different topology: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. It does not verify the present outcome.
Question 425
An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. Which observed result would most directly prove the design meets the intended goal?
- The optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible.
- The hub forwards only to reachable site prefixes or intentionally documented summary ranges.
- Branch routes remain reachable through the surviving aggregation router after failure.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Explanation
Correct Answer
C:Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It does not verify the present outcome.
B:This observation relates to a different topology: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. It does not verify the present outcome.
D:This observation relates to a different topology: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not verify the present outcome.
Question 426
A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. Which observed result would most directly prove the design meets the intended goal?
- The intended adjacency comes up at the correct level and interarea destinations remain reachable.
- Route reachability between distant IS-IS areas is present through level-2 adjacencies.
- The branch receives the intended interarea destinations and no unwanted external LSAs.
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
Explanation
Correct Answer
B:Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: New routers have valid IP addresses but IS-IS peers in separate areas never form a level-1 adjacency. It does not verify the present outcome.
C:This observation relates to a different topology: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It does not verify the present outcome.
D:This observation would validate a different case: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It does not establish the target outcome for this topology.
Question 427
A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. Which observed result would most directly prove the design meets the intended goal?
- Changes to one tenant's routes do not leak or alter the other's forwarding state.
- Clients retain gateway reachability after either distribution switch fails.
- Both paths carry approved traffic and a member failure has no broad STP reconvergence.
- Both failure exercises satisfy the documented outage budget without skipping required policy checks.
Explanation
Correct Answer
A:Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not verify the present outcome.
C:This observation relates to a different topology: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It does not verify the present outcome.
D:This observation relates to a different topology: A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. It does not verify the present outcome.
Question 428
A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. Which observed result would most directly prove the design meets the intended goal?
- Excess guest bursts are contained while voice packet-delay variation remains acceptable.
- Priority queuing protects genuine voice media while backup traffic no longer occupies the strict-priority class.
- Voice latency and packet loss stay within the approved limit during controlled WAN congestion.
- All essential classes receive their planned treatment without violating actual egress capacity.
Explanation
Correct Answer
D:Create feasible bandwidth allocations and an explicit priority bandwidth budget that sums within supported scheduler constraints. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. It does not verify the present outcome.
B:This observation relates to a different topology: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not verify the present outcome.
C:This observation relates to a different topology: A regional WAN prioritizes voice using a DiffServ marking but provides no scheduler preference on its congested egress link. It does not verify the present outcome.
Question 429
GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. Which observed result would most directly prove the design meets the intended goal?
- Finance sites reach only designated hubs while approved other segments preserve their intended paths.
- Approved endpoints encrypt traffic while retaining the provider's intended any-to-any routing paths.
- Surviving key servers provide policies and secure data traffic remains operational through maintenance.
- Selected tunnels meet the approved performance envelope during representative conference traffic.
Explanation
Correct Answer
C:Design redundant supported key servers and registration/rekey recovery for the group encryption domain. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It does not verify the present outcome.
B:This observation relates to a different topology: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It does not verify the present outcome.
D:This observation relates to a different topology: A video conference SD-WAN policy accepts tunnels with 1% packet loss but ignores sustained jitter above application tolerance. It does not verify the present outcome.
Question 430
IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. Which observed result would most directly prove the design meets the intended goal?
- All approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
- Only the approved number of endpoint identities can use the port while rogue downstream devices are blocked.
- The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
- The rogue bridge cannot become campus root and protected access interfaces enter their intended security state.
Explanation
Correct Answer
A:Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It does not verify the present outcome.
C:This observation relates to a different topology: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It does not verify the present outcome.
D:This observation relates to a different topology: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It does not verify the present outcome.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
